1 Testing the ruleset rendered from the default firewall configuration.
5 include("./root/usr/share/firewall4/main.uc", {
8 getenv: function(varname) {
28 hook ingress priority 0;
29 devices = { "eth0", "eth1" };
36 # CT helper definitions
40 type "amanda" protocol udp;
44 type "ftp" protocol tcp;
48 type "RAS" protocol udp;
52 type "Q.931" protocol tcp;
56 type "irc" protocol tcp;
59 ct helper netbios-ns {
60 type "netbios-ns" protocol udp;
64 type "pptp" protocol tcp;
68 type "sane" protocol tcp;
72 type "sip" protocol udp;
76 type "snmp" protocol udp;
80 type "tftp" protocol udp;
84 type "rtsp" protocol tcp;
92 define lan_devices = { "br-lan" }
93 define lan_subnets = { 10.0.0.0/24, 192.168.26.0/24, 2001:db8:1000::/60, fd63:e2f:f706::/60 }
95 define wan_devices = { "pppoe-wan" }
96 define wan_subnets = { 10.11.12.0/24, 2001:db8:54:321::/64 }
103 include "/etc/nftables.d/*.nft"
111 type filter hook input priority filter; policy drop;
113 iifname "lo" accept comment "!fw4: Accept traffic from loopback"
115 ct state established,related accept comment "!fw4: Allow inbound established and related flows"
116 tcp flags & (fin | syn | rst | ack) == syn jump syn_flood comment "!fw4: Rate limit TCP syn packets"
117 iifname "br-lan" jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic"
118 iifname "pppoe-wan" jump input_wan comment "!fw4: Handle wan IPv4/IPv6 input traffic"
123 type filter hook forward priority filter; policy drop;
125 meta l4proto { tcp, udp } flow offload @ft;
126 ct state established,related accept comment "!fw4: Allow forwarded established and related flows"
127 iifname "br-lan" jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic"
128 iifname "pppoe-wan" jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic"
133 type filter hook output priority filter; policy accept;
135 oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
137 ct state established,related accept comment "!fw4: Allow outbound established and related flows"
138 meta l4proto tcp counter comment "!fw4: Test-Deprecated-Rule-Option"
139 oifname "br-lan" jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic"
140 oifname "pppoe-wan" jump output_wan comment "!fw4: Handle wan IPv4/IPv6 output traffic"
144 type filter hook prerouting priority filter; policy accept;
145 iifname "br-lan" jump helper_lan comment "!fw4: Handle lan IPv4/IPv6 helper assignment"
148 chain handle_reject {
149 meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
150 reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
154 limit rate 25/second burst 50 packets return comment "!fw4: Accept SYN packets below rate-limit"
155 drop comment "!fw4: Drop excess packets"
167 jump accept_to_wan comment "!fw4: Accept lan to wan forwarding"
172 meta l4proto udp udp dport 10080 ct helper set "amanda" comment "!fw4: Amanda backup and archiving proto"
173 meta l4proto tcp tcp dport 21 ct helper set "ftp" comment "!fw4: FTP passive connection tracking"
174 meta l4proto udp udp dport 1719 ct helper set "RAS" comment "!fw4: RAS proto tracking"
175 meta l4proto tcp tcp dport 1720 ct helper set "Q.931" comment "!fw4: Q.931 proto tracking"
176 meta nfproto ipv4 meta l4proto tcp tcp dport 6667 ct helper set "irc" comment "!fw4: IRC DCC connection tracking"
177 meta nfproto ipv4 meta l4proto udp udp dport 137 ct helper set "netbios-ns" comment "!fw4: NetBIOS name service broadcast tracking"
178 meta nfproto ipv4 meta l4proto tcp tcp dport 1723 ct helper set "pptp" comment "!fw4: PPTP VPN connection tracking"
179 meta l4proto tcp tcp dport 6566 ct helper set "sane" comment "!fw4: SANE scanner connection tracking"
180 meta l4proto udp udp dport 5060 ct helper set "sip" comment "!fw4: SIP VoIP connection tracking"
181 meta nfproto ipv4 meta l4proto udp udp dport 161 ct helper set "snmp" comment "!fw4: SNMP monitoring connection tracking"
182 meta l4proto udp udp dport 69 ct helper set "tftp" comment "!fw4: TFTP connection tracking"
183 meta nfproto ipv4 meta l4proto tcp tcp dport 554 ct helper set "rtsp" comment "!fw4: RTSP connection tracking"
186 chain accept_from_lan {
187 iifname "br-lan" counter accept comment "!fw4: accept lan IPv4/IPv6 traffic"
190 chain accept_to_lan {
191 oifname "br-lan" counter accept comment "!fw4: accept lan IPv4/IPv6 traffic"
195 meta nfproto ipv4 udp dport 68 counter accept comment "!fw4: Allow-DHCP-Renew"
196 meta nfproto ipv4 icmp type 8 counter accept comment "!fw4: Allow-Ping"
197 meta nfproto ipv4 meta l4proto igmp counter accept comment "!fw4: Allow-IGMP"
198 ip6 saddr fc00::/6 ip6 daddr fc00::/6 udp dport 546 counter accept comment "!fw4: Allow-DHCPv6"
199 ip6 saddr fe80::/10 icmpv6 type . icmpv6 code { 130 . 0, 131 . 0, 132 . 0, 143 . 0 } counter accept comment "!fw4: Allow-MLD"
200 meta nfproto ipv6 icmpv6 type { 128, 129, 1, 3, 133, 134 } limit rate 1000/second counter accept comment "!fw4: Allow-ICMPv6-Input"
201 meta nfproto ipv6 icmpv6 type . icmpv6 code { 2 . 0, 4 . 0, 4 . 1, 135 . 0, 136 . 0 } limit rate 1000/second counter accept comment "!fw4: Allow-ICMPv6-Input"
210 meta nfproto ipv6 icmpv6 type { 128, 129, 1, 3 } limit rate 1000/second counter accept comment "!fw4: Allow-ICMPv6-Forward"
211 meta nfproto ipv6 icmpv6 type . icmpv6 code { 2 . 0, 4 . 0, 4 . 1 } limit rate 1000/second counter accept comment "!fw4: Allow-ICMPv6-Forward"
212 meta l4proto esp counter jump accept_to_lan comment "!fw4: Allow-IPSec-ESP"
213 udp dport 500 counter jump accept_to_lan comment "!fw4: Allow-ISAKMP"
217 chain accept_to_wan {
218 meta nfproto ipv4 oifname "pppoe-wan" ct state invalid counter drop comment "!fw4: Prevent NAT leakage"
219 oifname "pppoe-wan" counter accept comment "!fw4: accept wan IPv4/IPv6 traffic"
222 chain reject_from_wan {
223 iifname "pppoe-wan" counter jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
226 chain reject_to_wan {
227 oifname "pppoe-wan" counter jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
236 type nat hook prerouting priority dstnat; policy accept;
240 type nat hook postrouting priority srcnat; policy accept;
241 oifname "pppoe-wan" jump srcnat_wan comment "!fw4: Handle wan IPv4/IPv6 srcnat traffic"
245 meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 wan traffic"
250 # Raw rules (notrack)
253 chain raw_prerouting {
254 type filter hook prerouting priority raw; policy accept;
258 type filter hook output priority raw; policy accept;
266 chain mangle_prerouting {
267 type filter hook prerouting priority mangle; policy accept;
270 chain mangle_postrouting {
271 type filter hook postrouting priority mangle; policy accept;
275 type filter hook input priority mangle; policy accept;
278 chain mangle_output {
279 type route hook output priority mangle; policy accept;
282 chain mangle_forward {
283 type filter hook forward priority mangle; policy accept;
284 iifname "pppoe-wan" tcp flags syn tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 ingress MTU fixing"
285 oifname "pppoe-wan" tcp flags syn tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 egress MTU fixing"
291 [call] ctx.call object <network.interface> method <dump> args <null>
292 [call] ctx.call object <service> method <get_data> args <{ "type": "firewall" }>
293 [call] fs.open path </proc/version> mode <r>
294 [call] fs.stat path </sys/module/nf_conntrack_amanda>
295 [call] fs.stat path </sys/module/nf_conntrack_ftp>
296 [call] fs.stat path </sys/module/nf_conntrack_h323>
297 [call] fs.stat path </sys/module/nf_conntrack_h323>
298 [call] fs.stat path </sys/module/nf_conntrack_irc>
299 [call] fs.stat path </sys/module/nf_conntrack_netbios_ns>
300 [call] fs.stat path </sys/module/nf_conntrack_pptp>
301 [call] fs.stat path </sys/module/nf_conntrack_sane>
302 [call] fs.stat path </sys/module/nf_conntrack_sip>
303 [call] fs.stat path </sys/module/nf_conntrack_snmp>
304 [call] fs.stat path </sys/module/nf_conntrack_tftp>
305 [call] fs.stat path </sys/module/nf_conntrack_rtsp>
306 [!] Section @defaults[0] specifies unknown option 'unknown_defaults_option'
307 [!] Section @rule[9] (Test-Deprecated-Rule-Option) option '_name' is deprecated by fw4
308 [!] Section @rule[9] (Test-Deprecated-Rule-Option) specifies unknown option 'unknown_rule_option'
309 [call] fs.glob pattern </usr/share/nftables.d/ruleset-pre/*.nft>
310 [call] fs.glob pattern </usr/share/nftables.d/ruleset-post/*.nft>
311 [call] fs.glob pattern </usr/share/nftables.d/table-pre/*.nft>
312 [call] fs.glob pattern </usr/share/nftables.d/table-post/*.nft>
313 [call] fs.lsdir path </usr/share/nftables.d/chain-pre>
314 [call] fs.lsdir path </usr/share/nftables.d/chain-post>
315 [call] ctx.call object <network.device> method <status> args <null>
316 [call] fs.opendir path </sys/class/net/br-lan>
317 [call] fs.opendir path </sys/class/net/eth0>
318 [call] fs.opendir path </sys/class/net/eth1>
319 [call] system command </usr/sbin/nft -c '
320 add table inet fw4-hw-offload-test;
321 add flowtable inet fw4-hw-offload-test ft {
322 hook ingress priority 0;
323 devices = { "eth0", "eth1" };
326 ' 2>/dev/null> timeout <null>
327 [call] fs.popen cmdline </usr/sbin/nft --terse --json list flowtables inet> mode <r>
328 [call] fs.readfile path </sys/class/net/br-lan/flags> limit <null>
329 [call] fs.readfile path </sys/class/net/br-lan/flags> limit <null>